MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7e74a06abe8b9a67e3451e4db658c4c98c8cfc146fcd4508f15a3c3c9abfd53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MassLogger


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7e74a06abe8b9a67e3451e4db658c4c98c8cfc146fcd4508f15a3c3c9abfd53
SHA3-384 hash: 7235725f8041aada28cdd67e12668076751fdc03bbcc77cb9f23940966494325277255a9bc9196b4bef91cc994882dbd
SHA1 hash: 178d6431d004dd68020ac20b9178147bede4d3a3
MD5 hash: 3bf1cd173a289d135b401fe5d8ed0d24
humanhash: cardinal-maine-hydrogen-early
File name:payment swift document.uu
Download: download sample
Signature MassLogger
Create hunting rule
File size:649'824 bytes
First seen:2020-08-05 12:16:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:XBRW/7a94I4EIIpQDzRayvG8kz6HKR23Dx8KvIv/UBrxlnjL87lvrO+yNcv4:xRA7auIAvRxefGqcDx8GIv/U9clvrOF5
TLSH 1BD423597DCE48DE376E4B8A547E7A34678F8EB9343D18320F214B4B7C6262C96258C2
Reporter abuse_ch
Tags:MassLogger uu


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mx.diyarbakiroto.com.tr
Sending IP: 176.53.12.184
From: Sales <trkstandardlarenstits@yandex.com>
Subject: Bank transfer swift
Attachment: payment swift document.uu (contains "payment swift document.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7e74a06abe8b9a67e3451e4db658c4c98c8cfc146fcd4508f15a3c3c9abfd53/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 12:18:09 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=27tuubvl5c42m7rukhsnwzmmjsmmrt6bi36niuepcwr4hsnl7vjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d7e74a06abe8b9a67e3451e4db658c4c98c8cfc146fcd4508f15a3c3c9abfd53

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

MassLogger

rar d7e74a06abe8b9a67e3451e4db658c4c98c8cfc146fcd4508f15a3c3c9abfd53

(this sample)

MassLogger

Executable exe 84321d91850ce025e214ab49400d8c1fade931a55483a87582f4f266e3ec196b

  
Dropping
MD5 0fd03812371717183da460e6e5aad0f4
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 84321d91850ce025e214ab49400d8c1fade931a55483a87582f4f266e3ec196b

Comments